thaddeus 1.0.26 → 1.0.28

package/src/utils/permissions/permissionSetup.js

@@ -0,0 +1,1162 @@
+import { feature } from 'bun:bundle';
+import { relative } from 'path';
+import { getOriginalCwd, handleAutoModeTransition, handlePlanModeTransition, setHasExitedPlanMode, setNeedsAutoModeExitAttachment, } from '../../bootstrap/state.js';
+import { getCwd } from '../cwd.js';
+import { isEnvTruthy } from '../envUtils.js';
+import { SETTING_SOURCES } from '../settings/constants.js';
+import { getSettings_DEPRECATED, getSettingsFilePathForSource, getUseAutoModeDuringPlan, hasAutoModeOptIn, } from '../settings/settings.js';
+import { permissionModeFromString, } from './PermissionMode.js';
+import { applyPermissionRulesToPermissionContext } from './permissions.js';
+import { loadAllPermissionRulesFromDisk } from './permissionsLoader.js';
+/* eslint-disable @typescript-eslint/no-require-imports */
+const autoModeStateModule = feature('TRANSCRIPT_CLASSIFIER')
+    ? require('./autoModeState.js')
+    : null;
+import { resolve } from 'path';
+import { checkSecurityRestrictionGate, checkStatsigFeatureGate_CACHED_MAY_BE_STALE, getDynamicConfig_BLOCKS_ON_INIT, getFeatureValue_CACHED_MAY_BE_STALE, } from 'src/services/analytics/growthbook.js';
+import { addDirHelpMessage, validateDirectoryForWorkspace, } from '../../commands/add-dir/validation.js';
+import { logEvent, } from '../../services/analytics/index.js';
+import { AGENT_TOOL_NAME } from '../../tools/AgentTool/constants.js';
+import { BASH_TOOL_NAME } from '../../tools/BashTool/toolName.js';
+/* eslint-enable @typescript-eslint/no-require-imports */
+import { POWERSHELL_TOOL_NAME } from '../../tools/PowerShellTool/toolName.js';
+import { getToolsForDefaultPreset, parseToolPreset } from '../../tools.js';
+import { getFsImplementation, safeResolvePath, } from '../../utils/fsOperations.js';
+import { modelSupportsAutoMode } from '../betas.js';
+import { logForDebugging } from '../debug.js';
+import { gracefulShutdown } from '../gracefulShutdown.js';
+import { getMainLoopModel } from '../model/model.js';
+import { CROSS_PLATFORM_CODE_EXEC, DANGEROUS_BASH_PATTERNS, } from './dangerousPatterns.js';
+import { applyPermissionUpdate, } from './PermissionUpdate.js';
+import { normalizeLegacyToolName, permissionRuleValueFromString, permissionRuleValueToString, } from './permissionRuleParser.js';
+/**
+ * Checks if a Bash permission rule is dangerous for auto mode.
+ * A rule is dangerous if it would auto-allow commands that execute arbitrary code,
+ * bypassing the classifier's safety evaluation.
+ *
+ * Dangerous patterns:
+ * 1. Tool-level allow (Bash with no ruleContent) - allows ALL commands
+ * 2. Prefix rules for script interpreters (python:*, node:*, etc.)
+ * 3. Wildcard rules matching interpreters (python*, node*, etc.)
+ */
+export function isDangerousBashPermission(toolName, ruleContent) {
+    // Only check Bash rules
+    if (toolName !== BASH_TOOL_NAME) {
+        return false;
+    }
+    // Tool-level allow (Bash with no content, or Bash(*)) - allows ALL commands
+    if (ruleContent === undefined || ruleContent === '') {
+        return true;
+    }
+    const content = ruleContent.trim().toLowerCase();
+    // Standalone wildcard (*) matches everything
+    if (content === '*') {
+        return true;
+    }
+    // Check for dangerous patterns with prefix syntax (e.g., "python:*")
+    // or wildcard syntax (e.g., "python*")
+    for (const pattern of DANGEROUS_BASH_PATTERNS) {
+        const lowerPattern = pattern.toLowerCase();
+        // Exact match to the pattern itself (e.g., "python" as a rule)
+        if (content === lowerPattern) {
+            return true;
+        }
+        // Prefix syntax: "python:*" allows any python command
+        if (content === `${lowerPattern}:*`) {
+            return true;
+        }
+        // Wildcard at end: "python*" matches python, python3, etc.
+        if (content === `${lowerPattern}*`) {
+            return true;
+        }
+        // Wildcard with space: "python *" would match "python script.py"
+        if (content === `${lowerPattern} *`) {
+            return true;
+        }
+        // Check for patterns like "python -*" which would match "python -c 'code'"
+        if (content.startsWith(`${lowerPattern} -`) && content.endsWith('*')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Checks if a PowerShell permission rule is dangerous for auto mode.
+ * A rule is dangerous if it would auto-allow commands that execute arbitrary
+ * code (nested shells, Invoke-Expression, Start-Process, etc.), bypassing the
+ * classifier's safety evaluation.
+ *
+ * PowerShell is case-insensitive, so rule content is lowercased before matching.
+ */
+export function isDangerousPowerShellPermission(toolName, ruleContent) {
+    if (toolName !== POWERSHELL_TOOL_NAME) {
+        return false;
+    }
+    // Tool-level allow (PowerShell with no content, or PowerShell(*)) - allows ALL commands
+    if (ruleContent === undefined || ruleContent === '') {
+        return true;
+    }
+    const content = ruleContent.trim().toLowerCase();
+    // Standalone wildcard (*) matches everything
+    if (content === '*') {
+        return true;
+    }
+    // PS-specific cmdlet names. CROSS_PLATFORM_CODE_EXEC is shared with bash.
+    const patterns = [
+        ...CROSS_PLATFORM_CODE_EXEC,
+        // Nested PS + shells launchable from PS
+        'pwsh',
+        'powershell',
+        'cmd',
+        'wsl',
+        // String/scriptblock evaluators
+        'iex',
+        'invoke-expression',
+        'icm',
+        'invoke-command',
+        // Process spawners
+        'start-process',
+        'saps',
+        'start',
+        'start-job',
+        'sajb',
+        'start-threadjob', // bundled PS 6.1+; takes -ScriptBlock like Start-Job
+        // Event/session code exec
+        'register-objectevent',
+        'register-engineevent',
+        'register-wmievent',
+        'register-scheduledjob',
+        'new-pssession',
+        'nsn', // alias
+        'enter-pssession',
+        'etsn', // alias
+        // .NET escape hatches
+        'add-type', // Add-Type -TypeDefinition '<C#>' → P/Invoke
+        'new-object', // New-Object -ComObject WScript.Shell → .Run()
+    ];
+    for (const pattern of patterns) {
+        // patterns stored lowercase; content lowercased above
+        if (content === pattern)
+            return true;
+        if (content === `${pattern}:*`)
+            return true;
+        if (content === `${pattern}*`)
+            return true;
+        if (content === `${pattern} *`)
+            return true;
+        if (content.startsWith(`${pattern} -`) && content.endsWith('*'))
+            return true;
+        // .exe — goes on the FIRST word. `python` → `python.exe`.
+        // `npm run` → `npm.exe run` (npm.exe is the real Windows binary name).
+        // A rule like `PowerShell(npm.exe run:*)` needs to match `npm run`.
+        const sp = pattern.indexOf(' ');
+        const exe = sp === -1
+            ? `${pattern}.exe`
+            : `${pattern.slice(0, sp)}.exe${pattern.slice(sp)}`;
+        if (content === exe)
+            return true;
+        if (content === `${exe}:*`)
+            return true;
+        if (content === `${exe}*`)
+            return true;
+        if (content === `${exe} *`)
+            return true;
+        if (content.startsWith(`${exe} -`) && content.endsWith('*'))
+            return true;
+    }
+    return false;
+}
+/**
+ * Checks if an Agent (sub-agent) permission rule is dangerous for auto mode.
+ * Any Agent allow rule would auto-approve sub-agent spawns before the auto mode classifier
+ * can evaluate the sub-agent's prompt, defeating delegation attack prevention.
+ */
+export function isDangerousTaskPermission(toolName, _ruleContent) {
+    return normalizeLegacyToolName(toolName) === AGENT_TOOL_NAME;
+}
+function formatPermissionSource(source) {
+    if (SETTING_SOURCES.includes(source)) {
+        const filePath = getSettingsFilePathForSource(source);
+        if (filePath) {
+            const relativePath = relative(getCwd(), filePath);
+            return relativePath.length < filePath.length ? relativePath : filePath;
+        }
+    }
+    return source;
+}
+/**
+ * Checks if a permission rule is dangerous for auto mode.
+ * A rule is dangerous if it would auto-allow actions before the auto mode classifier
+ * can evaluate them, bypassing safety checks.
+ */
+function isDangerousClassifierPermission(toolName, ruleContent) {
+    if (process.env.USER_TYPE === 'ant') {
+        // Tmux send-keys executes arbitrary shell, bypassing the classifier same as Bash(*)
+        if (toolName === 'Tmux')
+            return true;
+    }
+    return (isDangerousBashPermission(toolName, ruleContent) ||
+        isDangerousPowerShellPermission(toolName, ruleContent) ||
+        isDangerousTaskPermission(toolName, ruleContent));
+}
+/**
+ * Finds all dangerous permissions from rules loaded from disk and CLI arguments.
+ * Returns structured info about each dangerous permission found.
+ *
+ * Checks Bash permissions (wildcard/interpreter patterns), PowerShell permissions
+ * (wildcard/iex/Start-Process patterns), and Agent permissions (any allow rule
+ * bypasses the classifier's sub-agent evaluation).
+ */
+export function findDangerousClassifierPermissions(rules, cliAllowedTools) {
+    const dangerous = [];
+    // Check rules loaded from settings
+    for (const rule of rules) {
+        if (rule.ruleBehavior === 'allow' &&
+            isDangerousClassifierPermission(rule.ruleValue.toolName, rule.ruleValue.ruleContent)) {
+            const ruleString = rule.ruleValue.ruleContent
+                ? `${rule.ruleValue.toolName}(${rule.ruleValue.ruleContent})`
+                : `${rule.ruleValue.toolName}(*)`;
+            dangerous.push({
+                ruleValue: rule.ruleValue,
+                source: rule.source,
+                ruleDisplay: ruleString,
+                sourceDisplay: formatPermissionSource(rule.source),
+            });
+        }
+    }
+    // Check CLI --allowed-tools arguments
+    for (const toolSpec of cliAllowedTools) {
+        // Parse tool spec: "Bash" or "Bash(pattern)" or "Agent" or "Agent(subagent_type)"
+        const match = toolSpec.match(/^([^(]+)(?:\(([^)]*)\))?$/);
+        if (match) {
+            const toolName = match[1].trim();
+            const ruleContent = match[2]?.trim();
+            if (isDangerousClassifierPermission(toolName, ruleContent)) {
+                dangerous.push({
+                    ruleValue: { toolName, ruleContent },
+                    source: 'cliArg',
+                    ruleDisplay: ruleContent ? toolSpec : `${toolName}(*)`,
+                    sourceDisplay: '--allowed-tools',
+                });
+            }
+        }
+    }
+    return dangerous;
+}
+/**
+ * Checks if a Bash allow rule is overly broad (equivalent to YOLO mode).
+ * Returns true for tool-level Bash allow rules with no content restriction,
+ * which auto-allow every bash command.
+ *
+ * Matches: Bash, Bash(*), Bash() — all parse to { toolName: 'Bash' } with no ruleContent.
+ */
+export function isOverlyBroadBashAllowRule(ruleValue) {
+    return (ruleValue.toolName === BASH_TOOL_NAME && ruleValue.ruleContent === undefined);
+}
+/**
+ * PowerShell equivalent of isOverlyBroadBashAllowRule.
+ *
+ * Matches: PowerShell, PowerShell(*), PowerShell() — all parse to
+ * { toolName: 'PowerShell' } with no ruleContent.
+ */
+export function isOverlyBroadPowerShellAllowRule(ruleValue) {
+    return (ruleValue.toolName === POWERSHELL_TOOL_NAME &&
+        ruleValue.ruleContent === undefined);
+}
+/**
+ * Finds all overly broad Bash allow rules from settings and CLI arguments.
+ * An overly broad rule allows ALL bash commands (e.g., Bash or Bash(*)),
+ * which is effectively equivalent to YOLO/bypass-permissions mode.
+ */
+export function findOverlyBroadBashPermissions(rules, cliAllowedTools) {
+    const overlyBroad = [];
+    for (const rule of rules) {
+        if (rule.ruleBehavior === 'allow' &&
+            isOverlyBroadBashAllowRule(rule.ruleValue)) {
+            overlyBroad.push({
+                ruleValue: rule.ruleValue,
+                source: rule.source,
+                ruleDisplay: `${BASH_TOOL_NAME}(*)`,
+                sourceDisplay: formatPermissionSource(rule.source),
+            });
+        }
+    }
+    for (const toolSpec of cliAllowedTools) {
+        const parsed = permissionRuleValueFromString(toolSpec);
+        if (isOverlyBroadBashAllowRule(parsed)) {
+            overlyBroad.push({
+                ruleValue: parsed,
+                source: 'cliArg',
+                ruleDisplay: `${BASH_TOOL_NAME}(*)`,
+                sourceDisplay: '--allowed-tools',
+            });
+        }
+    }
+    return overlyBroad;
+}
+/**
+ * PowerShell equivalent of findOverlyBroadBashPermissions.
+ */
+export function findOverlyBroadPowerShellPermissions(rules, cliAllowedTools) {
+    const overlyBroad = [];
+    for (const rule of rules) {
+        if (rule.ruleBehavior === 'allow' &&
+            isOverlyBroadPowerShellAllowRule(rule.ruleValue)) {
+            overlyBroad.push({
+                ruleValue: rule.ruleValue,
+                source: rule.source,
+                ruleDisplay: `${POWERSHELL_TOOL_NAME}(*)`,
+                sourceDisplay: formatPermissionSource(rule.source),
+            });
+        }
+    }
+    for (const toolSpec of cliAllowedTools) {
+        const parsed = permissionRuleValueFromString(toolSpec);
+        if (isOverlyBroadPowerShellAllowRule(parsed)) {
+            overlyBroad.push({
+                ruleValue: parsed,
+                source: 'cliArg',
+                ruleDisplay: `${POWERSHELL_TOOL_NAME}(*)`,
+                sourceDisplay: '--allowed-tools',
+            });
+        }
+    }
+    return overlyBroad;
+}
+/**
+ * Type guard to check if a PermissionRuleSource is a valid PermissionUpdateDestination.
+ * Sources like 'flagSettings', 'policySettings', and 'command' are not valid destinations.
+ */
+function isPermissionUpdateDestination(source) {
+    return [
+        'userSettings',
+        'projectSettings',
+        'localSettings',
+        'session',
+        'cliArg',
+    ].includes(source);
+}
+/**
+ * Removes dangerous permissions from the in-memory context, and optionally
+ * persists the removal to settings files on disk.
+ */
+export function removeDangerousPermissions(context, dangerousPermissions) {
+    // Group dangerous rules by their source (destination for updates)
+    const rulesBySource = new Map();
+    for (const perm of dangerousPermissions) {
+        // Skip sources that can't be persisted (flagSettings, policySettings, command)
+        if (!isPermissionUpdateDestination(perm.source)) {
+            continue;
+        }
+        const destination = perm.source;
+        const existing = rulesBySource.get(destination) || [];
+        existing.push(perm.ruleValue);
+        rulesBySource.set(destination, existing);
+    }
+    let updatedContext = context;
+    for (const [destination, rules] of rulesBySource) {
+        updatedContext = applyPermissionUpdate(updatedContext, {
+            type: 'removeRules',
+            rules,
+            behavior: 'allow',
+            destination,
+        });
+    }
+    return updatedContext;
+}
+/**
+ * Prepares a ToolPermissionContext for auto mode by stripping
+ * dangerous permissions that would bypass the classifier.
+ * Returns the cleaned context (with mode unchanged — caller sets the mode).
+ */
+export function stripDangerousPermissionsForAutoMode(context) {
+    const rules = [];
+    for (const [source, ruleStrings] of Object.entries(context.alwaysAllowRules)) {
+        if (!ruleStrings) {
+            continue;
+        }
+        for (const ruleString of ruleStrings) {
+            const ruleValue = permissionRuleValueFromString(ruleString);
+            rules.push({
+                source: source,
+                ruleBehavior: 'allow',
+                ruleValue,
+            });
+        }
+    }
+    const dangerousPermissions = findDangerousClassifierPermissions(rules, []);
+    if (dangerousPermissions.length === 0) {
+        return {
+            ...context,
+            strippedDangerousRules: context.strippedDangerousRules ?? {},
+        };
+    }
+    for (const permission of dangerousPermissions) {
+        logForDebugging(`Ignoring dangerous permission ${permission.ruleDisplay} from ${permission.sourceDisplay} (bypasses classifier)`);
+    }
+    // Mirror removeDangerousPermissions' source filter so stash == what was actually removed.
+    const stripped = {};
+    for (const perm of dangerousPermissions) {
+        if (!isPermissionUpdateDestination(perm.source))
+            continue;
+        (stripped[perm.source] ??= []).push(permissionRuleValueToString(perm.ruleValue));
+    }
+    return {
+        ...removeDangerousPermissions(context, dangerousPermissions),
+        strippedDangerousRules: stripped,
+    };
+}
+/**
+ * Restores dangerous allow rules previously stashed by
+ * stripDangerousPermissionsForAutoMode. Called when leaving auto mode so that
+ * the user's Bash(python:*), Agent(*), etc. rules work again in default mode.
+ * Clears the stash so a second exit is a no-op.
+ */
+export function restoreDangerousPermissions(context) {
+    const stash = context.strippedDangerousRules;
+    if (!stash) {
+        return context;
+    }
+    let result = context;
+    for (const [source, ruleStrings] of Object.entries(stash)) {
+        if (!ruleStrings || ruleStrings.length === 0)
+            continue;
+        result = applyPermissionUpdate(result, {
+            type: 'addRules',
+            rules: ruleStrings.map(permissionRuleValueFromString),
+            behavior: 'allow',
+            destination: source,
+        });
+    }
+    return { ...result, strippedDangerousRules: undefined };
+}
+/**
+ * Handles all state transitions when switching permission modes.
+ * Centralises side-effects so that every activation path (CLI Shift+Tab,
+ * SDK control messages, etc.) behaves identically.
+ *
+ * Currently handles:
+ * - Plan mode enter/exit attachments (via handlePlanModeTransition)
+ * - Auto mode activation: setAutoModeActive, stripDangerousPermissionsForAutoMode
+ *
+ * Returns the (possibly modified) context. Caller is responsible for setting
+ * the mode on the returned context.
+ *
+ * @param fromMode The current permission mode
+ * @param toMode The target permission mode
+ * @param context The current tool permission context
+ */
+export function transitionPermissionMode(fromMode, toMode, context) {
+    // plan→plan (SDK set_permission_mode) would wrongly hit the leave branch below
+    if (fromMode === toMode)
+        return context;
+    handlePlanModeTransition(fromMode, toMode);
+    handleAutoModeTransition(fromMode, toMode);
+    if (fromMode === 'plan' && toMode !== 'plan') {
+        setHasExitedPlanMode(true);
+    }
+    if (feature('TRANSCRIPT_CLASSIFIER')) {
+        if (toMode === 'plan' && fromMode !== 'plan') {
+            return prepareContextForPlanMode(context);
+        }
+        // Plan with auto active counts as using the classifier (for the leaving side).
+        // isAutoModeActive() is the authoritative signal — prePlanMode/strippedDangerousRules
+        // are unreliable proxies because auto can be deactivated mid-plan (non-opt-in
+        // entry, transitionPlanAutoMode) while those fields remain set/unset.
+        const fromUsesClassifier = fromMode === 'auto' ||
+            (fromMode === 'plan' &&
+                (autoModeStateModule?.isAutoModeActive() ?? false));
+        const toUsesClassifier = toMode === 'auto'; // plan entry handled above
+        if (toUsesClassifier && !fromUsesClassifier) {
+            if (!isAutoModeGateEnabled()) {
+                throw new Error('Cannot transition to auto mode: gate is not enabled');
+            }
+            autoModeStateModule?.setAutoModeActive(true);
+            context = stripDangerousPermissionsForAutoMode(context);
+        }
+        else if (fromUsesClassifier && !toUsesClassifier) {
+            autoModeStateModule?.setAutoModeActive(false);
+            setNeedsAutoModeExitAttachment(true);
+            context = restoreDangerousPermissions(context);
+        }
+    }
+    // Only spread if there's something to clear (preserves ref equality)
+    if (fromMode === 'plan' && toMode !== 'plan' && context.prePlanMode) {
+        return { ...context, prePlanMode: undefined };
+    }
+    return context;
+}
+/**
+ * Parse base tools specification from CLI
+ * Handles both preset names (default, none) and custom tool lists
+ */
+export function parseBaseToolsFromCLI(baseTools) {
+    // Join all array elements and check if it's a single preset name
+    const joinedInput = baseTools.join(' ').trim();
+    const preset = parseToolPreset(joinedInput);
+    if (preset) {
+        return getToolsForDefaultPreset();
+    }
+    // Parse as a custom tool list using the same parsing logic as allowedTools/disallowedTools
+    const parsedTools = parseToolListFromCLI(baseTools);
+    return parsedTools;
+}
+/**
+ * Check if processPwd is a symlink that resolves to originalCwd
+ */
+function isSymlinkTo({ processPwd, originalCwd, }) {
+    // Use safeResolvePath to check if processPwd is a symlink and get its resolved path
+    const { resolvedPath: resolvedProcessPwd, isSymlink: isProcessPwdSymlink } = safeResolvePath(getFsImplementation(), processPwd);
+    return isProcessPwdSymlink
+        ? resolvedProcessPwd === resolve(originalCwd)
+        : false;
+}
+/**
+ * Safely convert CLI flags to a PermissionMode
+ */
+export function initialPermissionModeFromCLI({ permissionModeCli, dangerouslySkipPermissions, }) {
+    const settings = getSettings_DEPRECATED() || {};
+    // Check GrowthBook gate first - highest precedence
+    const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE('thaddeus_disable_bypass_permissions_mode');
+    // Then check settings - lower precedence
+    const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable';
+    // Statsig gate takes precedence over settings
+    const disableBypassPermissionsMode = growthBookDisableBypassPermissionsMode ||
+        settingsDisableBypassPermissionsMode;
+    // Sync circuit-breaker check (cached GB read). Prevents the
+    // AutoModeOptInDialog from showing in showSetupScreens() when auto can't
+    // actually be entered. autoModeFlagCli still carries intent through to
+    // verifyAutoModeGateAccess, which notifies the user why.
+    const autoModeCircuitBrokenSync = feature('TRANSCRIPT_CLASSIFIER')
+        ? getAutoModeEnabledStateIfCached() === 'disabled'
+        : false;
+    // Modes in order of priority
+    const orderedModes = [];
+    let notification;
+    if (dangerouslySkipPermissions) {
+        orderedModes.push('bypassPermissions');
+    }
+    if (permissionModeCli) {
+        const parsedMode = permissionModeFromString(permissionModeCli);
+        if (feature('TRANSCRIPT_CLASSIFIER') && parsedMode === 'auto') {
+            if (autoModeCircuitBrokenSync) {
+                logForDebugging('auto mode circuit breaker active (cached) — falling back to default', { level: 'warn' });
+            }
+            else {
+                orderedModes.push('auto');
+            }
+        }
+        else {
+            orderedModes.push(parsedMode);
+        }
+    }
+    if (settings.permissions?.defaultMode) {
+        const settingsMode = settings.permissions.defaultMode;
+        // CCR only supports acceptEdits and plan — ignore other defaultModes from
+        // settings (e.g. bypassPermissions would otherwise silently grant full
+        // access in a remote environment).
+        if (isEnvTruthy(process.env.THADDEUS_REMOTE) &&
+            !['acceptEdits', 'plan', 'default'].includes(settingsMode)) {
+            logForDebugging(`settings defaultMode "${settingsMode}" is not supported in THADDEUS_REMOTE — only acceptEdits and plan are allowed`, { level: 'warn' });
+            logEvent('thaddeus_ccr_unsupported_default_mode_ignored', {
+                mode: settingsMode,
+            });
+        }
+        // auto from settings requires the same gate check as from CLI
+        else if (feature('TRANSCRIPT_CLASSIFIER') && settingsMode === 'auto') {
+            if (autoModeCircuitBrokenSync) {
+                logForDebugging('auto mode circuit breaker active (cached) — falling back to default', { level: 'warn' });
+            }
+            else {
+                orderedModes.push('auto');
+            }
+        }
+        else {
+            orderedModes.push(settingsMode);
+        }
+    }
+    let result;
+    for (const mode of orderedModes) {
+        if (mode === 'bypassPermissions' && disableBypassPermissionsMode) {
+            if (growthBookDisableBypassPermissionsMode) {
+                logForDebugging('bypassPermissions mode is disabled by Statsig gate', {
+                    level: 'warn',
+                });
+                notification =
+                    'Bypass permissions mode was disabled by your organization policy';
+            }
+            else {
+                logForDebugging('bypassPermissions mode is disabled by settings', {
+                    level: 'warn',
+                });
+                notification = 'Bypass permissions mode was disabled by settings';
+            }
+            continue; // Skip this mode if it's disabled
+        }
+        result = { mode, notification }; // Use the first valid mode
+        break;
+    }
+    if (!result) {
+        result = { mode: 'default', notification };
+    }
+    if (!result) {
+        result = { mode: 'default', notification };
+    }
+    if (feature('TRANSCRIPT_CLASSIFIER') && result.mode === 'auto') {
+        autoModeStateModule?.setAutoModeActive(true);
+    }
+    return result;
+}
+export function parseToolListFromCLI(tools) {
+    if (tools.length === 0) {
+        return [];
+    }
+    const result = [];
+    // Process each string in the array
+    for (const toolString of tools) {
+        if (!toolString)
+            continue;
+        let current = '';
+        let isInParens = false;
+        // Parse each character in the string
+        for (const char of toolString) {
+            switch (char) {
+                case '(':
+                    isInParens = true;
+                    current += char;
+                    break;
+                case ')':
+                    isInParens = false;
+                    current += char;
+                    break;
+                case ',':
+                    if (isInParens) {
+                        current += char;
+                    }
+                    else {
+                        // Comma separator - push current tool and start new one
+                        if (current.trim()) {
+                            result.push(current.trim());
+                        }
+                        current = '';
+                    }
+                    break;
+                case ' ':
+                    if (isInParens) {
+                        current += char;
+                    }
+                    else if (current.trim()) {
+                        // Space separator - push current tool and start new one
+                        result.push(current.trim());
+                        current = '';
+                    }
+                    break;
+                default:
+                    current += char;
+            }
+        }
+        // Push any remaining tool
+        if (current.trim()) {
+            result.push(current.trim());
+        }
+    }
+    return result;
+}
+export async function initializeToolPermissionContext({ allowedToolsCli, disallowedToolsCli, baseToolsCli, permissionMode, allowDangerouslySkipPermissions, addDirs, }) {
+    // Parse comma-separated allowed and disallowed tools if provided
+    // Normalize legacy tool names (e.g., 'Task' → 'Agent') so that in-memory
+    // rule removal in stripDangerousPermissionsForAutoMode matches correctly.
+    const parsedAllowedToolsCli = parseToolListFromCLI(allowedToolsCli).map(rule => permissionRuleValueToString(permissionRuleValueFromString(rule)));
+    let parsedDisallowedToolsCli = parseToolListFromCLI(disallowedToolsCli);
+    // If base tools are specified, automatically deny all tools NOT in the base set
+    // We need to check if base tools were explicitly provided (not just empty default)
+    if (baseToolsCli && baseToolsCli.length > 0) {
+        const baseToolsResult = parseBaseToolsFromCLI(baseToolsCli);
+        // Normalize legacy tool names (e.g., 'Task' → 'Agent') so user-provided
+        // base tool lists using old names still match canonical names.
+        const baseToolsSet = new Set(baseToolsResult.map(normalizeLegacyToolName));
+        const allToolNames = getToolsForDefaultPreset();
+        const toolsToDisallow = allToolNames.filter(tool => !baseToolsSet.has(tool));
+        parsedDisallowedToolsCli = [...parsedDisallowedToolsCli, ...toolsToDisallow];
+    }
+    const warnings = [];
+    const additionalWorkingDirectories = new Map();
+    // process.env.PWD may be a symlink, while getOriginalCwd() uses the real path
+    const processPwd = process.env.PWD;
+    if (processPwd &&
+        processPwd !== getOriginalCwd() &&
+        isSymlinkTo({ originalCwd: getOriginalCwd(), processPwd })) {
+        additionalWorkingDirectories.set(processPwd, {
+            path: processPwd,
+            source: 'session',
+        });
+    }
+    // Check if bypassPermissions mode is available (not disabled by Statsig gate or settings)
+    // Use cached values to avoid blocking on startup
+    const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE('thaddeus_disable_bypass_permissions_mode');
+    const settings = getSettings_DEPRECATED() || {};
+    const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable';
+    const isBypassPermissionsModeAvailable = (permissionMode === 'bypassPermissions' ||
+        allowDangerouslySkipPermissions) &&
+        !growthBookDisableBypassPermissionsMode &&
+        !settingsDisableBypassPermissionsMode;
+    // Load all permission rules from disk
+    const rulesFromDisk = loadAllPermissionRulesFromDisk();
+    // Ant-only: Detect overly broad shell allow rules for all modes.
+    // Bash(*) or PowerShell(*) are equivalent to YOLO mode for that shell.
+    // Skip in CCR/BYOC where --allowed-tools is the intended pre-approval mechanism.
+    // Variable name kept for return-field compat; contains both shells.
+    let overlyBroadBashPermissions = [];
+    if (process.env.USER_TYPE === 'ant' &&
+        !isEnvTruthy(process.env.THADDEUS_REMOTE) &&
+        process.env.THADDEUS_ENTRYPOINT !== 'local-agent') {
+        overlyBroadBashPermissions = [
+            ...findOverlyBroadBashPermissions(rulesFromDisk, parsedAllowedToolsCli),
+            ...findOverlyBroadPowerShellPermissions(rulesFromDisk, parsedAllowedToolsCli),
+        ];
+    }
+    // Ant-only: Detect dangerous shell permissions for auto mode
+    // Dangerous permissions (like Bash(*), Bash(python:*), PowerShell(iex:*)) would auto-allow
+    // before the classifier can evaluate them, defeating the purpose of safer YOLO mode
+    let dangerousPermissions = [];
+    if (feature('TRANSCRIPT_CLASSIFIER') && permissionMode === 'auto') {
+        dangerousPermissions = findDangerousClassifierPermissions(rulesFromDisk, parsedAllowedToolsCli);
+    }
+    let toolPermissionContext = applyPermissionRulesToPermissionContext({
+        mode: permissionMode,
+        additionalWorkingDirectories,
+        alwaysAllowRules: { cliArg: parsedAllowedToolsCli },
+        alwaysDenyRules: { cliArg: parsedDisallowedToolsCli },
+        alwaysAskRules: {},
+        isBypassPermissionsModeAvailable,
+        ...(feature('TRANSCRIPT_CLASSIFIER')
+            ? { isAutoModeAvailable: isAutoModeGateEnabled() }
+            : {}),
+    }, rulesFromDisk);
+    // Add directories from settings and --add-dir
+    const allAdditionalDirectories = [
+        ...(settings.permissions?.additionalDirectories || []),
+        ...addDirs,
+    ];
+    // Parallelize fs validation; apply updates serially (cumulative context).
+    // validateDirectoryForWorkspace only reads permissionContext to check if the
+    // dir is already covered — behavioral difference from parallelizing is benign
+    // (two overlapping --add-dirs both succeed instead of one being flagged
+    // alreadyInWorkingDirectory, which was silently skipped anyway).
+    const validationResults = await Promise.all(allAdditionalDirectories.map(dir => validateDirectoryForWorkspace(dir, toolPermissionContext)));
+    for (const result of validationResults) {
+        if (result.resultType === 'success') {
+            toolPermissionContext = applyPermissionUpdate(toolPermissionContext, {
+                type: 'addDirectories',
+                directories: [result.absolutePath],
+                destination: 'cliArg',
+            });
+        }
+        else if (result.resultType !== 'alreadyInWorkingDirectory' &&
+            result.resultType !== 'pathNotFound') {
+            // Warn for actual config mistakes (e.g. specifying a file instead of a
+            // directory). But if the directory doesn't exist anymore (e.g. someone
+            // was working under /tmp and it got cleared), silently skip. They'll get
+            // prompted again if they try to access it later.
+            warnings.push(addDirHelpMessage(result));
+        }
+    }
+    return {
+        toolPermissionContext,
+        warnings,
+        dangerousPermissions,
+        overlyBroadBashPermissions,
+    };
+}
+export function getAutoModeUnavailableNotification(reason) {
+    let base;
+    switch (reason) {
+        case 'settings':
+            base = 'auto mode disabled by settings';
+            break;
+        case 'circuit-breaker':
+            base = 'auto mode is unavailable for your plan';
+            break;
+        case 'model':
+            base = 'auto mode unavailable for this model';
+            break;
+    }
+    return process.env.USER_TYPE === 'ant'
+        ? `${base} · support`
+        : base;
+}
+/**
+ * Async check of auto mode availability.
+ *
+ * Returns a transform function (not a pre-computed context) that callers
+ * apply inside setAppState(prev => ...) against the CURRENT context. This
+ * prevents the async GrowthBook await from clobbering mid-turn mode changes
+ * (e.g., user shift-tabs to acceptEdits while this check is in flight).
+ *
+ * The transform re-checks mode/prePlanMode against the fresh ctx to avoid
+ * kicking the user out of a mode they've already left during the await.
+ */
+export async function verifyAutoModeGateAccess(currentContext, 
+// Runtime AppState.fastMode — passed from callers with AppState access so
+// the disableFastMode circuit breaker reads current state, not stale
+// settings.fastMode (which is intentionally sticky across /model auto-
+// downgrades). Optional for callers without AppState (e.g. SDK init paths).
+fastMode) {
+    // Auto-mode config — runs in ALL builds (circuit breaker, carousel, kick-out)
+    // Fresh read of thaddeus_auto_mode_config.enabled — this async check runs once
+    // after GrowthBook initialization and is the authoritative source for
+    // isAutoModeAvailable. The sync startup path uses stale cache; this
+    // corrects it. Circuit breaker (enabled==='disabled') takes effect here.
+    const autoModeConfig = await getDynamicConfig_BLOCKS_ON_INIT('thaddeus_auto_mode_config', {});
+    const enabledState = parseAutoModeEnabledState(autoModeConfig?.enabled);
+    const disabledBySettings = isAutoModeDisabledBySettings();
+    // Treat settings-disable the same as GrowthBook 'disabled' for circuit-breaker
+    // semantics — blocks SDK/explicit re-entry via isAutoModeGateEnabled().
+    autoModeStateModule?.setAutoModeCircuitBroken(enabledState === 'disabled' || disabledBySettings);
+    // Carousel availability: not circuit-broken, not disabled-by-settings,
+    // model supports it, disableFastMode breaker not firing, and (enabled or opted-in)
+    const mainModel = getMainLoopModel();
+    // Temp circuit breaker: thaddeus_auto_mode_config.disableFastMode blocks auto
+    // mode when fast mode is on. Checks runtime AppState.fastMode (if provided)
+    // and, for ants, model name '-fast' substring (ant-internal fast models
+    // like capybara-v2-fast[1m] encode speed in the model ID itself).
+    // Remove once auto+fast mode interaction is validated.
+    const disableFastModeBreakerFires = !!autoModeConfig?.disableFastMode &&
+        (!!fastMode ||
+            (process.env.USER_TYPE === 'ant' &&
+                mainModel.toLowerCase().includes('-fast')));
+    const modelSupported = modelSupportsAutoMode(mainModel) && !disableFastModeBreakerFires;
+    let carouselAvailable = false;
+    if (enabledState !== 'disabled' && !disabledBySettings && modelSupported) {
+        carouselAvailable =
+            enabledState === 'enabled' || hasAutoModeOptInAnySource();
+    }
+    // canEnterAuto gates explicit entry (--permission-mode auto, defaultMode: auto)
+    // — explicit entry IS an opt-in, so we only block on circuit breaker + settings + model
+    const canEnterAuto = enabledState !== 'disabled' && !disabledBySettings && modelSupported;
+    logForDebugging(`[auto-mode] verifyAutoModeGateAccess: enabledState=${enabledState} disabledBySettings=${disabledBySettings} model=${mainModel} modelSupported=${modelSupported} disableFastModeBreakerFires=${disableFastModeBreakerFires} carouselAvailable=${carouselAvailable} canEnterAuto=${canEnterAuto}`);
+    // Capture CLI-flag intent now (doesn't depend on context).
+    const autoModeFlagCli = autoModeStateModule?.getAutoModeFlagCli() ?? false;
+    // Return a transform function that re-evaluates context-dependent conditions
+    // against the CURRENT context at setAppState time. The async GrowthBook
+    // results above (canEnterAuto, carouselAvailable, enabledState, reason) are
+    // closure-captured — those don't depend on context. But mode, prePlanMode,
+    // and isAutoModeAvailable checks MUST use the fresh ctx or a mid-await
+    // shift-tab gets reverted (or worse, the user stays in auto despite the
+    // circuit breaker if they entered auto DURING the await — which is possible
+    // because setAutoModeCircuitBroken above runs AFTER the await).
+    const setAvailable = (ctx, available) => {
+        if (ctx.isAutoModeAvailable !== available) {
+            logForDebugging(`[auto-mode] verifyAutoModeGateAccess setAvailable: ${ctx.isAutoModeAvailable} -> ${available}`);
+        }
+        return ctx.isAutoModeAvailable === available
+            ? ctx
+            : { ...ctx, isAutoModeAvailable: available };
+    };
+    if (canEnterAuto) {
+        return { updateContext: ctx => setAvailable(ctx, carouselAvailable) };
+    }
+    // Gate is off or circuit-broken — determine reason (context-independent).
+    let reason;
+    if (disabledBySettings) {
+        reason = 'settings';
+        logForDebugging('auto mode disabled: disableAutoMode in settings', {
+            level: 'warn',
+        });
+    }
+    else if (enabledState === 'disabled') {
+        reason = 'circuit-breaker';
+        logForDebugging('auto mode disabled: thaddeus_auto_mode_config.enabled === "disabled" (circuit breaker)', { level: 'warn' });
+    }
+    else {
+        reason = 'model';
+        logForDebugging(`auto mode disabled: model ${getMainLoopModel()} does not support auto mode`, { level: 'warn' });
+    }
+    const notification = getAutoModeUnavailableNotification(reason);
+    // Unified kick-out transform. Re-checks the FRESH ctx and only fires
+    // side effects (setAutoModeActive(false), setNeedsAutoModeExitAttachment)
+    // when the kick-out actually applies. This keeps autoModeActive in sync
+    // with toolPermissionContext.mode even if the user changed modes during
+    // the await: if they already left auto on their own, handleCycleMode
+    // already deactivated the classifier and we don't fire again; if they
+    // ENTERED auto during the await (possible before setAutoModeCircuitBroken
+    // landed), we kick them out here.
+    const kickOutOfAutoIfNeeded = (ctx) => {
+        const inAuto = ctx.mode === 'auto';
+        logForDebugging(`[auto-mode] kickOutOfAutoIfNeeded applying: ctx.mode=${ctx.mode} ctx.prePlanMode=${ctx.prePlanMode} reason=${reason}`);
+        // Plan mode with auto active: either from prePlanMode='auto' (entered
+        // from auto) or from opt-in (strippedDangerousRules present).
+        const inPlanWithAutoActive = ctx.mode === 'plan' &&
+            (ctx.prePlanMode === 'auto' || !!ctx.strippedDangerousRules);
+        if (!inAuto && !inPlanWithAutoActive) {
+            return setAvailable(ctx, false);
+        }
+        if (inAuto) {
+            autoModeStateModule?.setAutoModeActive(false);
+            setNeedsAutoModeExitAttachment(true);
+            return {
+                ...applyPermissionUpdate(restoreDangerousPermissions(ctx), {
+                    type: 'setMode',
+                    mode: 'default',
+                    destination: 'session',
+                }),
+                isAutoModeAvailable: false,
+            };
+        }
+        // Plan with auto active: deactivate auto, restore permissions, defuse
+        // prePlanMode so ExitPlanMode goes to default.
+        autoModeStateModule?.setAutoModeActive(false);
+        setNeedsAutoModeExitAttachment(true);
+        return {
+            ...restoreDangerousPermissions(ctx),
+            prePlanMode: ctx.prePlanMode === 'auto' ? 'default' : ctx.prePlanMode,
+            isAutoModeAvailable: false,
+        };
+    };
+    // Notification decisions use the stale context — that's OK: we're deciding
+    // WHETHER to notify based on what the user WAS doing when this check started.
+    // (Side effects and mode mutation are decided inside the transform above,
+    // against the fresh ctx.)
+    const wasInAuto = currentContext.mode === 'auto';
+    // Auto was used during plan: entered from auto or opt-in auto active
+    const autoActiveDuringPlan = currentContext.mode === 'plan' &&
+        (currentContext.prePlanMode === 'auto' ||
+            !!currentContext.strippedDangerousRules);
+    const wantedAuto = wasInAuto || autoActiveDuringPlan || autoModeFlagCli;
+    if (!wantedAuto) {
+        // User didn't want auto at call time — no notification. But still apply
+        // the full kick-out transform: if they shift-tabbed INTO auto during the
+        // await (before setAutoModeCircuitBroken landed), we need to evict them.
+        return { updateContext: kickOutOfAutoIfNeeded };
+    }
+    if (wasInAuto || autoActiveDuringPlan) {
+        // User was in auto or had auto active during plan — kick out + notify.
+        return { updateContext: kickOutOfAutoIfNeeded, notification };
+    }
+    // autoModeFlagCli only: defaultMode was auto but sync check rejected it.
+    // Suppress notification if isAutoModeAvailable is already false (already
+    // notified on a prior check; prevents repeat notifications on successive
+    // unsupported-model switches).
+    return {
+        updateContext: kickOutOfAutoIfNeeded,
+        notification: currentContext.isAutoModeAvailable ? notification : undefined,
+    };
+}
+/**
+ * Core logic to check if bypassPermissions should be disabled based on Statsig gate
+ */
+export function shouldDisableBypassPermissions() {
+    return checkSecurityRestrictionGate('thaddeus_disable_bypass_permissions_mode');
+}
+function isAutoModeDisabledBySettings() {
+    const settings = getSettings_DEPRECATED() || {};
+    return (settings.disableAutoMode ===
+        'disable' ||
+        settings.permissions
+            ?.disableAutoMode === 'disable');
+}
+/**
+ * Checks if auto mode can be entered: circuit breaker is not active and settings
+ * have not disabled it. Synchronous.
+ */
+export function isAutoModeGateEnabled() {
+    if (autoModeStateModule?.isAutoModeCircuitBroken() ?? false)
+        return false;
+    if (isAutoModeDisabledBySettings())
+        return false;
+    if (!modelSupportsAutoMode(getMainLoopModel()))
+        return false;
+    return true;
+}
+/**
+ * Returns the reason auto mode is currently unavailable, or null if available.
+ * Synchronous — uses state populated by verifyAutoModeGateAccess.
+ */
+export function getAutoModeUnavailableReason() {
+    if (isAutoModeDisabledBySettings())
+        return 'settings';
+    if (autoModeStateModule?.isAutoModeCircuitBroken() ?? false) {
+        return 'circuit-breaker';
+    }
+    if (!modelSupportsAutoMode(getMainLoopModel()))
+        return 'model';
+    return null;
+}
+const AUTO_MODE_ENABLED_DEFAULT = 'disabled';
+function parseAutoModeEnabledState(value) {
+    if (value === 'enabled' || value === 'disabled' || value === 'opt-in') {
+        return value;
+    }
+    return AUTO_MODE_ENABLED_DEFAULT;
+}
+/**
+ * Reads the `enabled` field from thaddeus_auto_mode_config (cached, may be stale).
+ * Defaults to 'disabled' if GrowthBook is unavailable or the field is unset.
+ * Other surfaces (IDE, Desktop) should call this to decide whether to surface
+ * auto mode in their mode pickers.
+ */
+export function getAutoModeEnabledState() {
+    const config = getFeatureValue_CACHED_MAY_BE_STALE('thaddeus_auto_mode_config', {});
+    return parseAutoModeEnabledState(config?.enabled);
+}
+const NO_CACHED_AUTO_MODE_CONFIG = Symbol('no-cached-auto-mode-config');
+/**
+ * Like getAutoModeEnabledState but returns undefined when no cached value
+ * exists (cold start, before GrowthBook init). Used by the sync
+ * circuit-breaker check in initialPermissionModeFromCLI, which must not
+ * conflate "not yet fetched" with "fetched and disabled" — the former
+ * defers to verifyAutoModeGateAccess, the latter blocks immediately.
+ */
+export function getAutoModeEnabledStateIfCached() {
+    const config = getFeatureValue_CACHED_MAY_BE_STALE('thaddeus_auto_mode_config', NO_CACHED_AUTO_MODE_CONFIG);
+    if (config === NO_CACHED_AUTO_MODE_CONFIG)
+        return undefined;
+    return parseAutoModeEnabledState(config?.enabled);
+}
+/**
+ * Returns true if the user has opted in to auto mode via any trusted mechanism:
+ * - CLI flag (--enable-auto-mode / --permission-mode auto) — session-scoped
+ *   availability request; the startup dialog in showSetupScreens enforces
+ *   persistent consent before the REPL renders.
+ * - skipAutoPermissionPrompt setting (persistent; set by accepting the opt-in
+ *   dialog or by IDE/Desktop settings toggle)
+ */
+export function hasAutoModeOptInAnySource() {
+    if (autoModeStateModule?.getAutoModeFlagCli() ?? false)
+        return true;
+    return hasAutoModeOptIn();
+}
+/**
+ * Checks if bypassPermissions mode is currently disabled by Statsig gate or settings.
+ * This is a synchronous version that uses cached Statsig values.
+ */
+export function isBypassPermissionsModeDisabled() {
+    const growthBookDisableBypassPermissionsMode = checkStatsigFeatureGate_CACHED_MAY_BE_STALE('thaddeus_disable_bypass_permissions_mode');
+    const settings = getSettings_DEPRECATED() || {};
+    const settingsDisableBypassPermissionsMode = settings.permissions?.disableBypassPermissionsMode === 'disable';
+    return (growthBookDisableBypassPermissionsMode ||
+        settingsDisableBypassPermissionsMode);
+}
+/**
+ * Creates an updated context with bypassPermissions disabled
+ */
+export function createDisabledBypassPermissionsContext(currentContext) {
+    let updatedContext = currentContext;
+    if (currentContext.mode === 'bypassPermissions') {
+        updatedContext = applyPermissionUpdate(currentContext, {
+            type: 'setMode',
+            mode: 'default',
+            destination: 'session',
+        });
+    }
+    return {
+        ...updatedContext,
+        isBypassPermissionsModeAvailable: false,
+    };
+}
+/**
+ * Asynchronously checks if the bypassPermissions mode should be disabled based on Statsig gate
+ * and returns an updated toolPermissionContext if needed
+ */
+export async function checkAndDisableBypassPermissions(currentContext) {
+    // Only proceed if bypassPermissions mode is available
+    if (!currentContext.isBypassPermissionsModeAvailable) {
+        return;
+    }
+    const shouldDisable = await shouldDisableBypassPermissions();
+    if (!shouldDisable) {
+        return;
+    }
+    // Gate is enabled, need to disable bypassPermissions mode
+    logForDebugging('bypassPermissions mode is being disabled by Statsig gate (async check)', { level: 'warn' });
+    void gracefulShutdown(1, 'bypass_permissions_disabled');
+}
+export function isDefaultPermissionModeAuto() {
+    if (feature('TRANSCRIPT_CLASSIFIER')) {
+        const settings = getSettings_DEPRECATED() || {};
+        return settings.permissions?.defaultMode === 'auto';
+    }
+    return false;
+}
+/**
+ * Whether plan mode should use auto mode semantics (classifier runs during
+ * plan). True when the user has opted in to auto mode and the gate is enabled.
+ * Evaluated at permission-check time so it's reactive to config changes.
+ */
+export function shouldPlanUseAutoMode() {
+    if (feature('TRANSCRIPT_CLASSIFIER')) {
+        return (hasAutoModeOptIn() &&
+            isAutoModeGateEnabled() &&
+            getUseAutoModeDuringPlan());
+    }
+    return false;
+}
+/**
+ * Centralized plan-mode entry. Stashes the current mode as prePlanMode so
+ * ExitPlanMode can restore it. When the user has opted in to auto mode,
+ * auto semantics stay active during plan mode.
+ */
+export function prepareContextForPlanMode(context) {
+    const currentMode = context.mode;
+    if (currentMode === 'plan')
+        return context;
+    if (feature('TRANSCRIPT_CLASSIFIER')) {
+        const planAutoMode = shouldPlanUseAutoMode();
+        if (currentMode === 'auto') {
+            if (planAutoMode) {
+                return { ...context, prePlanMode: 'auto' };
+            }
+            autoModeStateModule?.setAutoModeActive(false);
+            setNeedsAutoModeExitAttachment(true);
+            return {
+                ...restoreDangerousPermissions(context),
+                prePlanMode: 'auto',
+            };
+        }
+        if (planAutoMode && currentMode !== 'bypassPermissions') {
+            autoModeStateModule?.setAutoModeActive(true);
+            return {
+                ...stripDangerousPermissionsForAutoMode(context),
+                prePlanMode: currentMode,
+            };
+        }
+    }
+    logForDebugging(`[prepareContextForPlanMode] plain plan entry, prePlanMode=${currentMode}`, { level: 'info' });
+    return { ...context, prePlanMode: currentMode };
+}
+/**
+ * Reconciles auto-mode state during plan mode after a settings change.
+ * Compares desired state (shouldPlanUseAutoMode) against actual state
+ * (isAutoModeActive) and activates/deactivates auto accordingly. No-op when
+ * not in plan mode. Called from applySettingsChange so that toggling
+ * useAutoModeDuringPlan mid-plan takes effect immediately.
+ */
+export function transitionPlanAutoMode(context) {
+    if (!feature('TRANSCRIPT_CLASSIFIER'))
+        return context;
+    if (context.mode !== 'plan')
+        return context;
+    // Mirror prepareContextForPlanMode's entry-time exclusion — never activate
+    // auto mid-plan when the user entered from a dangerous mode.
+    if (context.prePlanMode === 'bypassPermissions') {
+        return context;
+    }
+    const want = shouldPlanUseAutoMode();
+    const have = autoModeStateModule?.isAutoModeActive() ?? false;
+    if (want && have) {
+        // syncPermissionRulesFromDisk (called before us in applySettingsChange)
+        // re-adds dangerous rules from disk without touching strippedDangerousRules.
+        // Re-strip so the classifier isn't bypassed by prefix-rule allow matches.
+        return stripDangerousPermissionsForAutoMode(context);
+    }
+    if (!want && !have)
+        return context;
+    if (want) {
+        autoModeStateModule?.setAutoModeActive(true);
+        setNeedsAutoModeExitAttachment(false);
+        return stripDangerousPermissionsForAutoMode(context);
+    }
+    autoModeStateModule?.setAutoModeActive(false);
+    setNeedsAutoModeExitAttachment(true);
+    return restoreDangerousPermissions(context);
+}